cursedbelt-server 4.30.1 → 4.32.0

package/dist/server/d1/pullD1.d.ts

@@ -18,13 +18,30 @@
  * the cutover (a GREEN backup of nothing current — the worst failure a backup has), guessing
  * D1 snapshots a stale copy while the Mac is live.
  *
- * ## 🔴 Why table by table, and through `wrangler`
+ * ## 🔴 Why paged `SELECT`s, and never `wrangler d1 export`
  *
- * `wrangler d1 export` REFUSES a whole database holding a virtual table — *"cannot export
- * databases with Virtual Tables (fts5)"*, measured on collections' first post-cutover night —
- * and a per-table export is allowed. `wrangler` rather than the REST API because the export
- * is typed SQL: the REST API's JSON cannot tell the REAL `5.0` from the INTEGER `5`
- * (`./http.ts` has the measurement), and a restore must put back what was there.
+ * **A D1 export blocks the database from serving anything else for as long as it runs**
+ * (Cloudflare's own docs). Measured on family 2026-09-25 00:32–00:33 UTC: a manual `bun run
+ * backup` — then a per-table `wrangler d1 export` — held production for ~28 s at a time, and
+ * 14 requests to the family Worker sat waiting and threw Error 1101 (wall p50 28 s, CPU p50
+ * 1.6 ms). Two earlier throws at 13:56/13:58 had the same shape. So every nightly backup of
+ * every app on this seam was a scheduled outage.
+ *
+ * Since 4.32.0 the rows are read with ordinary `wrangler d1 execute --remote` SELECTs, a page
+ * of {@link PAGE_ROWS} rows at a time on a rowid keyset, which D1 serves between other
+ * requests like any read. Each value comes back as SQLite's own `quote()` of it — an SQL
+ * literal, as TEXT — so the REAL `5.0` stays `5.0` and the INTEGER `5` stays `5` (the reason
+ * this used `export` and not the REST API's JSON: `./http.ts` has the measurement), a BLOB is
+ * `X'…'`, and `quote()` round-trips a double exactly. The dump is then the same
+ * `INSERT INTO …` text an export wrote, so everything after it is unchanged.
+ *
+ * Still table by table: a whole-database export refused fts5 (*"cannot export databases with
+ * Virtual Tables"*), and a virtual table's shadow tables are an index, rebuilt, never copied.
+ *
+ * 🔴 The trade: an export was one point in time; pages are not. A row written to one table
+ * while another is being paged may be in the snapshot without its partner. For a nightly
+ * backup that is the right trade against taking production down, and the row-count check
+ * below still refuses a load short of what was read.
  */
 export type BackupSourceChoice = {
     kind: 'file' | 'd1' | 'refuse';
@@ -50,6 +67,13 @@ export declare function servedRuntime(url: string, { attempts, sleep }?: {
     attempts?: number | undefined;
     sleep?: ((ms: number) => Promise<void>) | undefined;
 }): Promise<string | null>;
+/**
+ * Rows per paged `SELECT`. The fleet's largest table held 290 rows when this was set (collections'
+ * `items`, 2026-09-25) and one `wrangler` call costs ~1 s, so a page this size is one call per
+ * table for every app today. A page D1 refuses — too large a response — is halved and asked
+ * again, down to one row, before it is a refusal.
+ */
+export declare const PAGE_ROWS = 500;
 /** One `wrangler` invocation, as {@link pullD1ToSqlite} needs it. Injected so a spec runs none. */
 export type Wrangler = (args: string[]) => {
     code: number;
@@ -69,6 +93,8 @@ export declare function spawnWrangler(options: {
 }): Wrangler;
 /**
  * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ * {@link pullD1ToSqlite} no longer exports (see the header), so nothing here calls this since
+ * 4.32.0; it stays exported for anyone still reading an export file by hand.
  *
  * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
  * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
@@ -104,11 +130,34 @@ export interface PullD1Options {
     afterLoadSql?: string;
     wrangler: Wrangler;
 }
+/** How a table is walked in pages: by a rowid keyset, or — a `WITHOUT ROWID` table — by offset. */
+export interface TablePlan {
+    table: string;
+    columns: string[];
+    /** The rowid alias to page on, or `null` for a table with none (then `order` + OFFSET). */
+    key: string | null;
+    order: string[];
+}
+/**
+ * The paging plan for one table. The key is the first of `rowid`, `_rowid_`, `oid` that no
+ * declared column shadows — `items_fts_map` declares a column NAMED `rowid`, so it pages on
+ * `_rowid_`, which is the same value.
+ */
+export declare function tablePlan(table: string, ddl: string | null, cols: ReadonlyArray<{
+    name: string;
+    pk: number;
+}>): TablePlan;
+/** The SELECT for one page: the key (if any) and every column as its `quote()`d SQL literal. */
+export declare function pageSql(plan: TablePlan, limit: number, after: {
+    key?: number;
+    offset?: number;
+}): string;
 /**
- * Pull the live D1 database into a real SQLite file.
+ * Pull the live D1 database into a real SQLite file, reading it with paged SELECTs that never
+ * block production (see the header — this used to be `wrangler d1 export`, which did).
  *
  * 🔴 It THROWS rather than returning an empty database. Every layer beneath treats a readable
- * SQLite file as success, so an export that produced nothing would sail through the
+ * SQLite file as success, so a pull that produced nothing would sail through the
  * magic-byte check and `integrity_check` and land on the shelf with today's date on it.
  */
 export declare function pullD1ToSqlite(options: PullD1Options): Promise<void>;

package/dist/server/d1/pullD1.js

@@ -18,13 +18,30 @@
  * the cutover (a GREEN backup of nothing current — the worst failure a backup has), guessing
  * D1 snapshots a stale copy while the Mac is live.
  *
- * ## 🔴 Why table by table, and through `wrangler`
+ * ## 🔴 Why paged `SELECT`s, and never `wrangler d1 export`
  *
- * `wrangler d1 export` REFUSES a whole database holding a virtual table — *"cannot export
- * databases with Virtual Tables (fts5)"*, measured on collections' first post-cutover night —
- * and a per-table export is allowed. `wrangler` rather than the REST API because the export
- * is typed SQL: the REST API's JSON cannot tell the REAL `5.0` from the INTEGER `5`
- * (`./http.ts` has the measurement), and a restore must put back what was there.
+ * **A D1 export blocks the database from serving anything else for as long as it runs**
+ * (Cloudflare's own docs). Measured on family 2026-09-25 00:32–00:33 UTC: a manual `bun run
+ * backup` — then a per-table `wrangler d1 export` — held production for ~28 s at a time, and
+ * 14 requests to the family Worker sat waiting and threw Error 1101 (wall p50 28 s, CPU p50
+ * 1.6 ms). Two earlier throws at 13:56/13:58 had the same shape. So every nightly backup of
+ * every app on this seam was a scheduled outage.
+ *
+ * Since 4.32.0 the rows are read with ordinary `wrangler d1 execute --remote` SELECTs, a page
+ * of {@link PAGE_ROWS} rows at a time on a rowid keyset, which D1 serves between other
+ * requests like any read. Each value comes back as SQLite's own `quote()` of it — an SQL
+ * literal, as TEXT — so the REAL `5.0` stays `5.0` and the INTEGER `5` stays `5` (the reason
+ * this used `export` and not the REST API's JSON: `./http.ts` has the measurement), a BLOB is
+ * `X'…'`, and `quote()` round-trips a double exactly. The dump is then the same
+ * `INSERT INTO …` text an export wrote, so everything after it is unchanged.
+ *
+ * Still table by table: a whole-database export refused fts5 (*"cannot export databases with
+ * Virtual Tables"*), and a virtual table's shadow tables are an index, rebuilt, never copied.
+ *
+ * 🔴 The trade: an export was one point in time; pages are not. A row written to one table
+ * while another is being paged may be in the snapshot without its partner. For a nightly
+ * backup that is the right trade against taking production down, and the row-count check
+ * below still refuses a load short of what was read.
  */
 import { Database } from 'bun:sqlite';
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
@@ -82,8 +99,13 @@ export async function servedRuntime(url, { attempts = 3, sleep = (ms) => new Pro
     }
     return null;
 }
-/** How many times one table's export is asked for when wrangler says success and writes nothing. */
-const EXPORT_ATTEMPTS = 3;
+/**
+ * Rows per paged `SELECT`. The fleet's largest table held 290 rows when this was set (collections'
+ * `items`, 2026-09-25) and one `wrangler` call costs ~1 s, so a page this size is one call per
+ * table for every app today. A page D1 refuses — too large a response — is halved and asked
+ * again, down to one row, before it is a refusal.
+ */
+export const PAGE_ROWS = 500;
 /**
  * The argv that runs `wrangler`: THIS bun binary's `x`, never a bare `bunx` — a launchd job's
  * PATH has no `bunx` (task 2112), and vault's and patterns' nightly backups each carried this
@@ -104,6 +126,8 @@ export function spawnWrangler(options) {
 }
 /**
  * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ * {@link pullD1ToSqlite} no longer exports (see the header), so nothing here calls this since
+ * 4.32.0; it stays exported for anyone still reading an export file by hand.
  *
  * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
  * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
@@ -143,104 +167,148 @@ export function backupTables(rows) {
         .filter((name) => name === 'sqlite_sequence' || !name.startsWith('sqlite_'))
         .sort();
 }
+const sqlIdent = (name) => `"${name.replaceAll('"', '""')}"`;
+const sqlText = (text) => `'${text.replaceAll("'", "''")}'`;
+/** One `wrangler d1 execute --remote --json` — every statement's result rows, in order. */
+function execute(wrangler, database, sql) {
+    const r = wrangler(['d1', 'execute', database, '--remote', '--env=', '--json', '--command', sql]);
+    if (r.code !== 0)
+        throw new Error(r.stderr.trim() || r.stdout.trim() || `wrangler exited ${r.code}`);
+    const parsed = JSON.parse(r.stdout.slice(r.stdout.indexOf('[')));
+    return parsed.map((statement) => statement.results ?? []);
+}
+/**
+ * The paging plan for one table. The key is the first of `rowid`, `_rowid_`, `oid` that no
+ * declared column shadows — `items_fts_map` declares a column NAMED `rowid`, so it pages on
+ * `_rowid_`, which is the same value.
+ */
+export function tablePlan(table, ddl, cols) {
+    const columns = cols.map((c) => c.name);
+    if (columns.length === 0)
+        throw new Error(`D1 reports no columns for \`${table}\``);
+    const lower = new Set(columns.map((c) => c.toLowerCase()));
+    const withoutRowid = /\bWITHOUT\s+ROWID\b/i.test(ddl ?? '');
+    const key = withoutRowid ? null : (['rowid', '_rowid_', 'oid'].find((alias) => !lower.has(alias)) ?? null);
+    const pk = cols.filter((c) => c.pk > 0).sort((a, b) => a.pk - b.pk).map((c) => c.name);
+    return { table, columns, key, order: pk.length > 0 ? pk : columns };
+}
+/** The SELECT for one page: the key (if any) and every column as its `quote()`d SQL literal. */
+export function pageSql(plan, limit, after) {
+    const values = plan.columns.map((c, i) => `quote(${sqlIdent(c)}) AS c${i}`).join(', ');
+    if (plan.key) {
+        const where = after.key === undefined ? '' : ` WHERE ${plan.key} > ${after.key}`;
+        return `SELECT ${plan.key} AS k, ${values} FROM ${sqlIdent(plan.table)}${where} ORDER BY ${plan.key} LIMIT ${limit}`;
+    }
+    const order = plan.order.map(sqlIdent).join(', ');
+    return `SELECT ${values} FROM ${sqlIdent(plan.table)} ORDER BY ${order} LIMIT ${limit} OFFSET ${after.offset ?? 0}`;
+}
+/** Every row of one table as `INSERT INTO …;` lines, read in pages that never block D1. */
+function dumpTable(wrangler, database, plan) {
+    const into = `INSERT INTO ${sqlIdent(plan.table)} (${plan.columns.map(sqlIdent).join(', ')}) VALUES (`;
+    const lines = [];
+    let limit = PAGE_ROWS;
+    let after = {};
+    for (;;) {
+        let page;
+        try {
+            page = execute(wrangler, database, pageSql(plan, limit, after))[0] ?? [];
+        }
+        catch (error) {
+            if (limit > 1) {
+                limit = Math.max(1, Math.floor(limit / 2));
+                continue;
+            }
+            throw new Error(`could not read \`${plan.table}\` from D1: ${error.message}`);
+        }
+        for (const row of page) {
+            const literals = plan.columns.map((_, i) => row[`c${i}`]);
+            if (literals.some((v) => typeof v !== 'string')) {
+                throw new Error(`D1 returned a non-literal value paging \`${plan.table}\` — refusing a snapshot that may not restore`);
+            }
+            lines.push(`${into}${literals.join(', ')});`);
+        }
+        if (page.length < limit)
+            break;
+        after = plan.key ? { key: Number(page[page.length - 1]?.k) } : { offset: (after.offset ?? 0) + page.length };
+    }
+    return { text: lines.join('\n'), rows: lines.length };
+}
 /**
- * Pull the live D1 database into a real SQLite file.
+ * Pull the live D1 database into a real SQLite file, reading it with paged SELECTs that never
+ * block production (see the header — this used to be `wrangler d1 export`, which did).
  *
  * 🔴 It THROWS rather than returning an empty database. Every layer beneath treats a readable
- * SQLite file as success, so an export that produced nothing would sail through the
+ * SQLite file as success, so a pull that produced nothing would sail through the
  * magic-byte check and `integrity_check` and land on the shelf with today's date on it.
  */
 export async function pullD1ToSqlite(options) {
     const { destination, database, wrangler } = options;
-    const listed = wrangler([
-        'd1', 'execute', database, '--remote', '--env=', '--json',
-        '--command', "select name, sql from sqlite_master where type = 'table'",
-    ]);
-    if (listed.code !== 0)
-        throw new Error(`could not list D1's tables: ${listed.stderr.trim() || listed.stdout.trim()}`);
-    const json = listed.stdout.slice(listed.stdout.indexOf('['));
-    const rows = JSON.parse(json)[0]?.results ?? [];
+    let rows;
+    try {
+        rows = (execute(wrangler, database, "select name, sql from sqlite_master where type = 'table'")[0] ?? []);
+    }
+    catch (error) {
+        throw new Error(`could not list D1's tables: ${error.message}`);
+    }
     const tables = backupTables(rows);
     if (!tables.includes(options.requiredTable)) {
         throw new Error(`D1 lists no \`${options.requiredTable}\` table (saw: ${rows.map((r) => r.name).join(', ') || 'nothing'})`);
     }
-    let sql = '';
-    const dumps = [];
+    // Every table's columns in ONE call: one statement each, answered in order.
+    let columnSets;
     try {
-        for (const table of tables) {
-            const dump = `${destination}.${table}.sql`;
-            // 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
-            // collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
-            // command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
-            // asked for again, twice, before it is a refusal; a failure that persists still refuses,
-            // because a snapshot missing a table is not a backup.
-            let exported = { code: 1, stdout: '', stderr: 'not attempted' };
-            for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
-                exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
-                if (exported.code !== 0 || existsSync(dump))
-                    break;
-            }
-            if (exported.code !== 0) {
-                throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
-            }
-            if (!existsSync(dump)) {
-                throw new Error(`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`);
-            }
-            stripTrailingNuls(dump);
-            const text = readFileSync(dump, 'utf8');
-            dumps.push({ table, text });
-            sql += `${text}\n`;
-        }
-        if (!/INSERT INTO/i.test(sql)) {
-            throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
+        columnSets = execute(wrangler, database, tables.map((t) => `SELECT name, pk FROM pragma_table_info(${sqlText(t)});`).join(' '));
+    }
+    catch (error) {
+        throw new Error(`could not read D1's columns: ${error.message}`);
+    }
+    const dumps = tables.map((table, i) => {
+        const cols = (columnSets[i] ?? []);
+        const plan = tablePlan(table, rows.find((r) => r.name === table)?.sql ?? null, cols);
+        return { table, ...dumpTable(wrangler, database, plan) };
+    });
+    if (dumps.every((d) => d.rows === 0)) {
+        throw new Error('the D1 pull contains no rows — refusing to snapshot an empty database as if it were the library');
+    }
+    const db = new Database(destination, { create: true });
+    try {
+        // `exec`, not `run`: each is many statements and `run` would execute only the first,
+        // leaving a file with a schema and no rows that looks perfectly valid.
+        db.exec(options.schemaSql);
+        // 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
+        // dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
+        // cache its art job creates where it first needs it — made the whole pull refuse with
+        // `no such table`, because its rows were exported and its table was not in the schema.
+        const have = new Set(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name));
+        for (const row of rows) {
+            if (!tables.includes(row.name) || have.has(row.name) || !row.sql)
+                continue;
+            db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
         }
-        const db = new Database(destination, { create: true });
-        try {
-            // `exec`, not `run`: each is many statements and `run` would execute only the first,
-            // leaving a file with a schema and no rows that looks perfectly valid.
-            db.exec(options.schemaSql);
-            // 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
-            // dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
-            // cache its art job creates where it first needs it — made the whole pull refuse with
-            // `no such table`, because its rows were exported and its table was not in the schema.
-            const have = new Set(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name));
-            for (const row of rows) {
-                if (!tables.includes(row.name) || have.has(row.name) || !row.sql)
-                    continue;
-                db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
-            }
-            // One table at a time, so a fault is located rather than smeared over the whole load.
-            for (const { text } of dumps)
-                if (text.trim())
-                    db.exec(text);
-            if (options.afterLoadSql)
-                db.exec(options.afterLoadSql);
-            // 🔴 Every table holds as many rows as its dump has INSERTs, or this is not a backup: the
-            // check that makes a silently truncated load — the NUL padding, or whatever does it next —
-            // a REFUSAL. A row count only; nothing here reads what the rows hold.
-            const short = [];
-            for (const { table, text } of dumps) {
-                if (table === 'sqlite_sequence')
-                    continue;
-                const expected = insertLines(text);
-                const loaded = db.query(`SELECT COUNT(*) AS n FROM "${table.replaceAll('"', '""')}"`).get().n;
-                if (loaded < expected)
-                    short.push(`${table}: ${loaded} of ${expected}`);
-            }
-            if (short.length > 0) {
-                db.close();
-                rmSync(destination, { force: true });
-                throw new Error(`the D1 pull did not load every exported row — ${short.join('; ')}. Refusing the snapshot.`);
-            }
+        // One table at a time, so a fault is located rather than smeared over the whole load.
+        for (const { text } of dumps)
+            if (text)
+                db.exec(text);
+        if (options.afterLoadSql)
+            db.exec(options.afterLoadSql);
+        // 🔴 Every table holds as many rows as were read from D1, or this is not a backup: the check
+        // that makes a silently truncated load (task 2128's NUL padding, or whatever does it next)
+        // a REFUSAL. A row count only; nothing here reads what the rows hold.
+        const short = [];
+        for (const { table, rows: expected } of dumps) {
+            if (table === 'sqlite_sequence')
+                continue;
+            const loaded = db.query(`SELECT COUNT(*) AS n FROM ${sqlIdent(table)}`).get().n;
+            if (loaded < expected)
+                short.push(`${table}: ${loaded} of ${expected}`);
         }
-        finally {
+        if (short.length > 0) {
             db.close();
+            rmSync(destination, { force: true });
+            throw new Error(`the D1 pull did not load every row it read — ${short.join('; ')}. Refusing the snapshot.`);
         }
     }
     finally {
-        // The per-table dumps are a second, unmanaged copy of the data that no retention rule
-        // would ever delete — eighteen were found beside vault's snapshot (task 2128).
-        for (const table of tables)
-            rmSync(`${destination}.${table}.sql`, { force: true });
+        db.close();
     }
 }

package/dist/server/master-lock/accountsPage.d.ts

@@ -11,9 +11,9 @@ export declare const MASTER_LOCK_ACCOUNTS_PAGE_PATHS: {
     readonly style: "/__lock/accounts.css";
     readonly script: "/__lock/accounts.js";
 };
-/** The shortest password worth calling one. Matched by every `minlength` below and by the
- *  lock page's enrollment form, so a rotation cannot quietly weaken what enrollment demands. */
-export declare const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
+/** The shortest password worth calling one — defined beside the lock page's enrollment form
+ *  (`lockPage.ts`) and re-exported, so a rotation cannot quietly differ from what enrollment demands. */
+export { MASTER_LOCK_MIN_PASSWORD_LENGTH } from "./lockPage.js";
 /**
  * The document.
  *

package/dist/server/master-lock/accountsPage.js

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_REVEAL_SOURCE, withRevealToggles } from "./lockPage.js";
+import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_MIN_PASSWORD_LENGTH, MASTER_LOCK_REVEAL_SOURCE, withRevealToggles } from "./lockPage.js";
 /**
  * The page's own two assets.
  *
@@ -47,9 +47,9 @@ export const MASTER_LOCK_ACCOUNTS_PAGE_PATHS = {
     script: `${MASTER_LOCK_PREFIX}/accounts.js`,
 };
 const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch] ?? ch);
-/** The shortest password worth calling one. Matched by every `minlength` below and by the
- *  lock page's enrollment form, so a rotation cannot quietly weaken what enrollment demands. */
-export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
+/** The shortest password worth calling one — defined beside the lock page's enrollment form
+ *  (`lockPage.ts`) and re-exported, so a rotation cannot quietly differ from what enrollment demands. */
+export { MASTER_LOCK_MIN_PASSWORD_LENGTH } from "./lockPage.js";
 /**
  * The document.
  *

package/dist/server/master-lock/lockPage.d.ts

@@ -1,3 +1,9 @@
+/**
+ * The shortest master password the wall accepts — every `minlength` on both pages and both
+ * scripts' own checks read this one number, so a rotation cannot quietly differ from enrollment.
+ * 10 until 2026-09-24; the owner: *"make the minimum password length 6 characters"*.
+ */
+export declare const MASTER_LOCK_MIN_PASSWORD_LENGTH = 6;
 /** Everything the page needs to know about the app it is standing in front of. */
 export interface LockPageOptions {
     /** What to call this app — "Collections", "binary-server inspector". */
@@ -21,18 +27,7 @@ export interface LockPageOptions {
  */
 export declare function lockPageHtml(options: LockPageOptions): string;
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
-export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n.secret{position:relative;display:block}\n.secret input{padding-right:68px}\n.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;\n  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);\n  font-size:12.5px;font-weight:600}\n.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}\n.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}\n";
-/**
- * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
- * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
- *
- * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
- * `<button type="button" data-reveal>` after it — the inputs keep every attribute, `autocomplete`
- * included, so a password manager still sees a password field. Behaviour:
- * {@link MASTER_LOCK_REVEAL_SOURCE}, interpolated into BOTH same-origin scripts, because the wall's
- * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
- * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
- */
+export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n.secret{position:relative;display:block}\n.secret input{padding-right:48px}\n.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:36px;height:32px;\n  display:grid;place-items:center;padding:0;border-radius:7px;background:none;color:var(--ml-muted)}\n.secret .reveal svg{width:18px;height:18px}\n.secret .reveal .eye-off,.secret .reveal[aria-pressed=\"true\"] .eye{display:none}\n.secret .reveal[aria-pressed=\"true\"] .eye-off{display:block}\n.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}\n.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}\n";
 export declare function withRevealToggles(html: string): string;
 /**
  * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
@@ -40,7 +35,7 @@ export declare function withRevealToggles(html: string): string;
  * `password` when its form submits — so a manager saving the credential sees a password field.
  * Publishes itself on `globalThis`, the seam `lockPage.spec.ts` drives it through.
  */
-export declare const MASTER_LOCK_REVEAL_SOURCE = "function wireMasterLockReveal(doc) {\n  const buttons = doc.querySelectorAll(\"[data-reveal]\");\n  for (const button of buttons) {\n    const input = button.previousElementSibling;\n    if (!input || input.tagName !== \"INPUT\") continue;\n    const show = (on) => {\n      input.type = on ? \"text\" : \"password\";\n      button.setAttribute(\"aria-pressed\", on ? \"true\" : \"false\");\n      button.setAttribute(\"aria-label\", on ? \"Hide password\" : \"Show password\");\n      button.textContent = on ? \"Hide\" : \"Show\";\n    };\n    button.addEventListener(\"click\", () => {\n      show(input.type === \"password\");\n      input.focus();\n    });\n    input.form?.addEventListener(\"submit\", () => show(false), true);\n  }\n  return buttons.length;\n}\nglobalThis.wireMasterLockReveal = wireMasterLockReveal;";
+export declare const MASTER_LOCK_REVEAL_SOURCE = "function wireMasterLockReveal(doc) {\n  const buttons = doc.querySelectorAll(\"[data-reveal]\");\n  for (const button of buttons) {\n    const input = button.previousElementSibling;\n    if (!input || input.tagName !== \"INPUT\") continue;\n    const show = (on) => {\n      input.type = on ? \"text\" : \"password\";\n      button.setAttribute(\"aria-pressed\", on ? \"true\" : \"false\");\n      button.setAttribute(\"aria-label\", on ? \"Hide password\" : \"Show password\");\n    };\n    button.addEventListener(\"click\", () => {\n      show(input.type === \"password\");\n      input.focus();\n    });\n    input.form?.addEventListener(\"submit\", () => show(false), true);\n  }\n  return buttons.length;\n}\nglobalThis.wireMasterLockReveal = wireMasterLockReveal;";
 /**
  * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
  * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the

package/dist/server/master-lock/lockPage.js

@@ -26,6 +26,12 @@
  * scripts interpolate this string, and the spec asserts that they do.
  */
 import { MASTER_LOCK_PATHS } from "cursedbelt-core/master-lock";
+/**
+ * The shortest master password the wall accepts — every `minlength` on both pages and both
+ * scripts' own checks read this one number, so a rotation cannot quietly differ from enrollment.
+ * 10 until 2026-09-24; the owner: *"make the minimum password length 6 characters"*.
+ */
+export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 6;
 const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch] ?? ch);
 /**
  * The document. Deliberately says the app's NAME and nothing else about it — whoever is
@@ -61,14 +67,14 @@ export function lockPageHtml(options) {
       <span>${enroll ? "New master password" : "Master password"}</span>
       <input id="ml-input" type="password" name="master-password"
              autocomplete="${enroll ? "new-password" : "current-password"}"
-             autofocus required spellcheck="false" enterkeyhint="${enroll ? "next" : "go"}"${enroll ? ' minlength="10"' : ""}>
+             autofocus required spellcheck="false" enterkeyhint="${enroll ? "next" : "go"}"${enroll ? ` minlength="${MASTER_LOCK_MIN_PASSWORD_LENGTH}"` : ""}>
     </label>${enroll
         ? `
     <label class="field">
       <span>Confirm master password</span>
       <input id="ml-confirm" type="password" name="confirm-master-password"
              autocomplete="new-password" required spellcheck="false" enterkeyhint="go"
-             minlength="10">
+             minlength="${MASTER_LOCK_MIN_PASSWORD_LENGTH}">
     </label>
     <label class="field">
       <span>Hint <em>optional</em></span>
@@ -129,15 +135,17 @@ button.quiet[disabled]{opacity:.5}
 .hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}
 .hints dd:last-child{margin-bottom:0}
 .secret{position:relative;display:block}
-.secret input{padding-right:68px}
-.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;
-  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);
-  font-size:12.5px;font-weight:600}
+.secret input{padding-right:48px}
+.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:36px;height:32px;
+  display:grid;place-items:center;padding:0;border-radius:7px;background:none;color:var(--ml-muted)}
+.secret .reveal svg{width:18px;height:18px}
+.secret .reveal .eye-off,.secret .reveal[aria-pressed="true"] .eye{display:none}
+.secret .reveal[aria-pressed="true"] .eye-off{display:block}
 .secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}
 .secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}
 `;
 /**
- * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * 🔴 Every password field on the wall gets an eye (show/hide) control (task 077-438's library share) — a
  * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
  *
  * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
@@ -147,8 +155,16 @@ button.quiet[disabled]{opacity:.5}
  * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
  * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
  */
+/*
+ * An eye, and an eye struck through — the owner, 2026-09-24: *"use an eye icon instead of words
+ * like 'Show'"*. Both are in the button; the stylesheet shows one by `aria-pressed`, so the
+ * script only flips state and the accessible name, never markup. Same glyphs as cursedbelt's
+ * React `SecretInput`, drawn inline because this page ships no icon font and no framework.
+ */
+const EYE = '<svg class="eye" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7S2 12 2 12z"/><circle cx="12" cy="12" r="3"/></svg>';
+const EYE_OFF = '<svg class="eye-off" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9.9 4.2A10.4 10.4 0 0 1 12 4c6.5 0 10 8 10 8a17.6 17.6 0 0 1-2.3 3.3"/><path d="M6.6 6.6C3.9 8.4 2 12 2 12s3.5 7 10 7c1.8 0 3.4-.5 4.8-1.3"/><path d="M9.9 9.9a3 3 0 0 0 4.2 4.2"/><path d="M2 2l20 20"/></svg>';
 export function withRevealToggles(html) {
-    return html.replace(/(<input\b[^>]*\btype="password"[^>]*>)/g, '<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">Show</button></span>');
+    return html.replace(/(<input\b[^>]*\btype="password"[^>]*>)/g, `<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">${EYE}${EYE_OFF}</button></span>`);
 }
 /**
  * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
@@ -165,7 +181,6 @@ export const MASTER_LOCK_REVEAL_SOURCE = `function wireMasterLockReveal(doc) {
       input.type = on ? "text" : "password";
       button.setAttribute("aria-pressed", on ? "true" : "false");
       button.setAttribute("aria-label", on ? "Hide password" : "Show password");
-      button.textContent = on ? "Hide" : "Show";
     };
     button.addEventListener("click", () => {
       show(input.type === "password");
@@ -252,7 +267,7 @@ const enrolling = document.body.dataset.mode === "enroll";
 
 /** The shortest password worth calling one. Matched by the input's own minlength, and
  *  checked here too because a pasted value can beat the constraint on some engines. */
-const MIN_LENGTH = 10;
+const MIN_LENGTH = ${MASTER_LOCK_MIN_PASSWORD_LENGTH};
 
 let kdf = null;
 let busy = false;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.30.1",
+	"version": "4.32.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",